fix(deploy kexec): ship static cpio+gzip (ZimaOS lacks them); single-password multiplex

kexec/run rebuilds an initrd via cpio|gzip from PATH — absent on ZimaOS, so run
aborted before kexec and the box stayed on ZimaOS. Ship GNU static cpio + busybox
(as gzip) into /tmp/bin, prepend PATH. SSH ControlMaster = one password prompt.

deploy

@@ -31,17 +31,32 @@ case "$cmd" in
     host="${1:-}"
     [ -n "$host" ] || { echo "usage: ./deploy kexec <ip-or-host>" >&2; exit 1; }
 
-    echo ">> building kexec installer (SSH key baked in)"
+    echo ">> building kexec installer + static tools"
     nix build .#nixosConfigurations.kexec.config.system.build.kexecInstallerTarball \
       -o result-kexec
     tb="$(ls result-kexec/*.tar.gz | head -1)"
+    # kexec/run rebuilds an initrd with `cpio` + `gzip` from PATH — ZimaOS lacks
+    # both. Ship static ones: GNU cpio (reliable -o -H newc), busybox as gzip.
+    cpio="$(nix build --no-link --print-out-paths nixpkgs#pkgsStatic.cpio)/bin/cpio"
+    bbox="$(nix build --no-link --print-out-paths nixpkgs#pkgsStatic.busybox)/bin/busybox"
 
-    echo ">> streaming installer to root@$host and kexec-ing  (enter root password)"
-    echo "   Extracted to /tmp (tmpfs); no compressed copy stored. SSH drops as"
-    echo "   the box jumps into the RAM installer. Disks are untouched."
-    # Stream the tarball straight into remote tar to avoid a second 522MB copy.
-    ssh "root@$host" 'mkdir -p /tmp/k && tar -C /tmp/k -xzf - && /tmp/k/kexec/run' < "$tb" || true
+    # One password prompt: multiplex scp + ssh over a shared control connection.
+    cm="/tmp/homelab-cm-%r@%h:%p"
+    o=(-o ControlMaster=auto -o "ControlPath=$cm" -o ControlPersist=300 \
+       -o StrictHostKeyChecking=accept-new)
 
+    echo ">> connecting to root@$host  (enter the ZimaOS root password once)"
+    ssh "${o[@]}" "root@$host" 'mkdir -p /tmp/bin'
+    scp "${o[@]}" "$cpio" "root@$host:/tmp/bin/cpio"
+    scp "${o[@]}" "$bbox" "root@$host:/tmp/bin/gzip"   # busybox as gzip (argv0)
+
+    echo ">> streaming installer + kexec-ing. SSH drops as the box jumps into the"
+    echo "   RAM installer. Disks are untouched."
+    ssh "${o[@]}" "root@$host" \
+      'chmod +x /tmp/bin/*; mkdir -p /tmp/k && tar -C /tmp/k -xzf - && PATH=/tmp/bin:$PATH /tmp/k/kexec/run' \
+      < "$tb" || true
+
+    ssh "${o[@]}" -O exit "root@$host" 2>/dev/null || true  # close control socket
     echo ">> box is kexec-ing. Wait ~1-2 min for the installer + network, then:"
     echo "   ./deploy install $host"
     ;;